metaport-agent-python 1.1.2

What is this?

A client library which connects any Python app to a Metaport server using the CycloneDX SBOM standard for data interchange.

How to use

Introduction

The library will automatically generate an SBOM for your app, submit it to Metaport and subsequently delete it. Data can be sent using the HTTP or Email transports. See the docs site for example requests.

When installed in a Python project, the library provides a single executable metaport. It's designed to be invoked on a schedule via cron from within an application's production environment or as part of a CI/CD pipeline.

This library supports traditional Pip, Poetry, and Pipfile based projects.

Vulnerabilities will be reported by this agent to your Metaport server by invoking the following commands (and in this order):

1. poetry audit
2. pip-audit

If neither command is available, no vulnerability data will be sent when using --classic=1. If however vulnerability data is required, consider running a side-by-side instance of DependencyTrack, and configuring Metaport with it for dependencies and vulnerabilities (and without passing --classic=1).

Requirements

This package requires Python 3.12+. If used as part of a CI/CD setup, it can be installed as a throwaway dependency via Poetry's --dev switch ala poetry add --dev, or as a permanent dependency of your application.

Install

1. Poetry

As part of production apps:

poetry add metaport-agent-python

2. Pip

pip install metaport-agent-python

3. Environment Variables

There are some environment variables which need to be set before the lib will operate correctly. Please see the docs site for more detailed installation and configuration instructions and examples.

Supported Frameworks and CMS's

Yours not listed? Contributions are very welcome. Please file an issue and issue a Merge Request, it's a one-line file change!

• Django
• Wagtail

The following frameworks do not currently share life-cycle information:

• Flask
• Quart
• Pyramid
• Bottle
• Django CMS
• Pylons
• FastAPI
• Tornado
• CherryPy
• web2py
• Falcon
• Sanic
• Starlette
• Molten
• Klein
• wheezy
• turbogears

Development Setup

Virtual Environment

# Create virtual environment
python -m venv .venv

# Activate virtual environment
# On Linux/macOS:
source .venv/bin/activate
# On Windows:
.venv\Scripts\activate

# Install development dependencies
pip install -r requirements-dev.txt

Using Poetry

# Install Poetry if not already installed
pip install poetry

# Install dependencies
poetry install

# Install dev-dependencies
./venv/bin/poetry install --extras dev

# Activate virtual environment
poetry shell